Internal Audit Checklist Template
The controls you are testing, with room to record what you found.
Details
internal audit checklist templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
| Area | [area under review] |
| Period covered | [period] |
| Reviewed by | [name] |
| Date | October 14, 2026 |
| What is being tested | Finding | Pass |
|---|---|---|
| [add one test per line] |
Conclusion
……………………………………………………………………………………………………………………
……………………………………………………………………………………………………………………
Every failed test needs a named owner and a date, recorded on the corrective action report rather than here.
What is an Internal Audit Checklist?
An internal audit checklist is the list of things you intend to test, with room beside each line to record what you actually found. It is what separates an audit from a walk round. It is also the working paper an external assessor will ask to see when they want to know how you reached your conclusion — and a checklist containing nothing but ticks demonstrates only that somebody held a pen.
Quality and compliance managers use it for the internal audit programme required by ISO management system standards — quality, environmental, occupational health and safety, information security — usually in the run-up to a certification or surveillance visit. Finance and internal audit teams use a version for control testing. In smaller organisations the auditor is often a manager from another department, trained for the purpose. The same checklist is also used for supplier audits and for following up a previous nonconformity.
What the audit must cover depends on the standard or framework you are assessed against rather than on geography. ISO management system standards require a planned audit programme and set expectations about auditor objectivity and independence. Section 404 of Sarbanes-Oxley drives control testing for companies listed in the US. The Institute of Internal Auditors' global standards govern how an internal audit function operates. Sector regulators in financial services, aviation, food safety and medical devices add their own requirements. Read the clause or rule you will be judged against.
A checklist is not the audit report. Findings, their evidence and their classification belong in the report, which is what management acts on. It is not a substitute for judgement either: an auditor who asks only what is printed on the sheet will walk past the thing standing in front of them. It is not a certification audit and confers no compliance on anyone. And it is not the management review, which is a separate activity with a separate record.
What to put in an Internal Audit Checklist
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issuing organisation | For example: Maple Grove Homeowners Association |
| Organisation address | For example: 1420 Kinnear Road, Columbus, OH 43212 |
| Area under review | For example: Purchase to pay — Auto Nagar site |
| Period covered | For example: 1 April 2026 to 31 August 2026 |
| Reviewed by | For example: Sarah Chen, Internal Audit |
| Checks | One per line: What you are testing | Finding (leave blank to fill by hand) |
How to write an Internal Audit Checklist
Fix the scope and criteria on the cover
Write on the front sheet which process, department, site and period you are auditing, and which criteria you are auditing against — named clauses of a standard, specific policies, a regulator's rule, a contract. Add the audit date, the auditor and the auditee. Scope creep during an audit is common and unhelpful; an agreed scope tells you what to leave for another day.
Turn each requirement into an evidence question
Do not copy clause wording into the question column. Write what you will look at. ‘Is training adequate?’ produces a conversation. ‘For the five operators on line 3, is there a signed competency record dated before their first shift on that line?’ produces documents, a sample and a defensible answer. Each question should name the record, the population and the test.
State the sample and record what you examined
Decide the sample size and how you will choose it before you arrive, then write down the actual identifiers you looked at: invoice numbers, batch codes, employee IDs, ticket references, dates. A checklist that says ‘records reviewed, satisfactory’ cannot be re-performed by anyone. One that lists eight specific invoice numbers can be checked, challenged and repeated next year.
Record findings as evidence, not verdicts
In the findings column write what you saw, where and when: the document, its date, its version, the person who showed it to you, and what was missing. Grade afterwards, using your own procedure's categories — conformity, observation, opportunity for improvement, minor or major nonconformity. Grading in the room, before you have compared notes, is how real findings get argued down to nothing.
Close with an owner, a date and verification
Every finding needs a named owner, an agreed date and a stated method of verification — what you will look at to confirm it is fixed, not a promise that it will be. Carry open items onto the next audit's checklist so they cannot quietly disappear, and record the date the correction was actually verified rather than the date it was promised.
Common mistakes
- Building the checklist as yes and no boxes with no space for evidence leaves you, six months later, unable to say what was actually examined.
- Auditing your own department because you know it best breaches the independence expectation in most standards, and the certification body discounts the whole audit.
- Reading clause wording aloud as the question gets a blank look from the auditee and produces an answer about the standard rather than about the process.
- Letting the process owner choose the records you sample means you test the three files they keep tidy and learn nothing about the rest.
- Closing a finding on a promised action rather than verified evidence puts the same nonconformity back on the table at the certification visit, with a worse grade.
Frequently asked questions
What should an internal audit checklist include?
The scope, criteria, date, auditor and auditee on the cover; a question per requirement written as a test with a named record and population; a column for the sample actually examined; a findings column for observations with dates and references; a grading column; and a closing section with owners, dates and verification method. Leave more space for findings than for questions.
Who can carry out an internal audit?
Someone competent in auditing and independent of the area being audited. Most standards do not require an external person or a formal qualification, but they do expect the auditor not to be auditing their own work. In small organisations that usually means cross-auditing between departments, or bringing in a contractor for the areas where nobody is independent.
How often should internal audits be carried out?
Most management system standards ask for a programme covering every process within a defined cycle, weighted by risk and by past performance, rather than fixing a frequency. Common practice is a full cycle each year with higher-risk processes visited more often. Check what your standard's audit clause actually says, and be able to justify the programme rather than just the interval.
What is the difference between an internal audit and an external audit?
An internal audit is carried out by or for the organisation itself, to find problems while there is still time to fix them. An external audit is carried out by a certification body, a regulator or an independent accountant, and reaches a formal conclusion that others rely on. The internal one is where you want the bad news to surface first.
Do I have to use a checklist for an internal audit?
Standards generally require planned audits with recorded results, not a checklist specifically. In practice a checklist is how most auditors demonstrate planning and coverage, and how a second auditor repeats the work. Use it as a prompt rather than a script: the best findings usually come from following something odd that was not on the sheet, and writing that down too.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.